Note: Automated spam monitoring stopped several years ago. These web pages are maintained for historical reasons. Some may be updated from time to time as news about the individual sites becomes available.No spam today
new: For information about Jerry Reynolds' SLAPP lawsuit against me, see this document.
Netzilla was the largest (as of Mar 1999) porn-spammer on Usenet. Netzilla was also known as or associated with Sexzilla.com, Intel Telecom Corporation, and ITC.
See also Newsfeeds.com.
Netzilla was (as of March 1999) hosted by UUNet and Cable & Wireless.
In late 1996, the whois data for netzilla.net identified the domain as being owned by Intel Telecom Corporation, with Jerry Reynolds listed as the contact person.
Intel Telecom Corporation (NETZILLA2-DOM) PO Box 6504 Fargo, ND 58109 US Domain Name: NETZILLA.NET Administrative Contact, Billing Contact: Reynolds, Jerry (JR3181) postmaster@SEXZILLA.COM 701-237-5131 (FAX) 701-237-5098 Technical Contact, Zone Contact: Reynolds, Gerald (GR1041) postmaster@SEXZILLA.COM 701-237-5131 (FAX) 701-237-5098 Record last updated on 03-Dec-96. Record created on 03-Dec-96. Domain servers in listed order: NS1.NETZILLA.NET 184.108.40.206 NS1.SEXZILLA.COM 220.127.116.11
In 1997, whois identified netzilla.net as:
ITC (NETZILLA2-DOM) PO box 954 Moorhead, MN 56561 US Domain Name: NETZILLA.NET Administrative Contact, Technical Contact, Zone Contact: Rick, Haider rick@NETZILLA.NET 701-237-5131 (FAX) 701-237-5131 Billing Contact: Rick, Haider rick@NETZILLA.NET 701-237-5131 (FAX) 701-237-5131 Record last updated on 23-Apr-97. Record created on 03-Dec-96. Database last updated on 15-Aug-97 04:28:55 EDT. Domain servers in listed order: NS1.NETZILLA.NET 18.104.22.168 NS1.SEXZILLA.COM 22.214.171.124
Note that the phone numbers are still the same as when the web site was registered to Jerry Reynolds.
As of 2004, the domain is no longer owned by Jerry Reynolds. The domain is now registered, apparently, to Yahoo with an address in Georgia. Nobody is named as a contact. There is no content on the web page.
As of 2005, Arin.net still lists Jerry Reynolds as the owner of Intel Telecom. (Type whois -h whois.arin.net +"Intel Telecom")
In 1996, the whois data for sexzilla.com identified the domain as being owned by Intel Telecom Corporation, with Jerry Reynolds listed as the contact person. Note the email address used by Reynolds at the time
Intel Telecom Corporation (SEXZILLA-DOM) PO Box 6504 Fargo, ND 58109 Domain Name: SEXZILLA.COM Administrative Contact, Technical Contact, Zone Contact: Jerry, Reynolds (RJ636) borrg@AOL.COM 701-237-5131 ^^^^^^^^^^^^^ Record last updated on 15-Dec-96. Record created on 25-Jun-96. Domain servers in listed order: NS1.SEXZILLA.COM 126.96.36.199 NS2.CORPCOMM.NET 188.8.131.52
In early 1997, the whois data for sexzilla.com identified the domain as being owned by Intel Telecom Corporation, with Jerry Reynolds listed as the contact person.
Intel Telecom Corporation SEXZILLA-DOM PO Box 6504 Fargo, ND 58109 Domain Name: SEXZILLA.COM Administrative Contact, Technical Contact, Zone Contact: Jerry, Reynolds RJ636 jerryr@NETZILLA.NET 701-237-5131 Record last updated on 15-Dec-96. Record created on 25-Jun-96. Domain servers in listed order: NS1.SEXZILLA.COM 184.108.40.206 NS2.CORPCOMM.NET 220.127.116.11
Another Intel Telecom Corporation record.
As of 2004, the domain is no longer owned by Jerry Reynolds. Sexzilla.com is now registered to a domain broker in the Cayman Islands.
The connection between Corpcomm.net and Netzilla/Sexzilla is not entirely clear at the moment. It is known that Corpcomm acted as the network service provider to Netzilla/Sexzilla and that Jerry Reynolds maintained an email address there.
The connection between Newsfeeds.com and Netzilla/Sexzilla is not entirely clear at the moment. It is known that Newsfeeds acted as a usenet feed for Netzilla/Sexzilla.
Netzilla was owned by Jerry Reynolds. Other contact names associated with Netzilla were:
Netzilla also owned the domains jam.net and newsfeeds.com. Netzilla misspelled these domains as jam.com and newsfeed.com as part of their routine path forgery. Note that there was a real newsfeed.com who was probably innocent.
See also: sierracorporatedesign.com, newsgroups.com, nntp.be, nuthinbutnews.com, superfeed.net, usenet.com, binaries.net, ojsimpson.net, jobtrek.com, ugroups.com, and spamkiller.net. Superfeed was previously owned by Brad Allison. As of June 2008, it was owned by Sierra Corporate Design. The rest are owned anonymously via Network Solutions.
See Usenet thread Re: What is spamkiller.net? for an analysis.
Because of forgery, it is sometimes hard to determine where Netzilla is coming from. It is believed they are using POPs, including those owned by linkup.net, UUNet, WillowSprings.mci.net, and fargo.nd.pub-ip.psi.net. UUNet, MCI and PSI remain unresponsive to complaints.
Netzilla Path: lines are heavily forged. The following is an anlysis of a netzilla Path: line, as provided by David Ritz:
Path: news.alt.net!news1.alt.net!news.exodus.net!paperboy01.iconnet.net! news-xfer.netaxs.com!cpk-news-hub1.bbnplanet.com!news.bbnplanet.com! howland.erols.net!nntp3.crl.com!news1.mid-ga.com!news.hom.net! 1 feed2.newsfeed.com! 2 news.ntl.net!news-feed.inet.com!gateway.cm.org! 2 news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net! 3 news.jam.com! 4 news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net! 4 news.iswest.net!iswest.com! 5 news.karlia.ru!roo.fosta.au!PopKey:
1 'Feed2.newsfeed.com' is actually newsfeeds.com which belongs to NetZilla.
2 Forged path inserted by Newsfeeds.com
3 "News.jam.com" is actually dnewsweb3.netzilla.net, which belongs to NetZilla.
4 Forged path inserted by 'news.jam.com'
5 "News.karlia.ru" and "roo.fosta.au" belong to NetZilla.
Note the forgery of cm.org, exit109.com, rahul.net, iswest.net and others in the Path: line. This is an attempt by the spammers to prevent spam-fighters from seeing the offending posts.
Date: stamps are forged as 24 hours in the future in order to make tracking
According to Howard Knight,
Netzilla owned, or was associated with, the following hosts:
|DNS address||Fake address||IP address|
* preloads the forged path:
news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us! rahul.net!news.iswest.net!iswest.com!news.karlia.ru** preloads the forged path:
The full text of one copy of the spam is archived here. The letter has proven to be an invaluable source of information on Jerry Reynolds, and has provided insight into the way he works. Howard K. and David Ritz have provided an analysis of the letter:
The email was sent from RRNet.com, a small ISP in Fargo, ND. RRNet kicked Reynolds off the site a long time ago, but Netzilla spam continued to arrive because Jerry would hire college students to sign up with RRNet and post spam.
This address was listed by the InterNIC in June of 1996 as being Jerry Reynold's contact address for Sexzilla.To: firstname.lastname@example.org
Addresses of interest in the letter are as follows:
"Mike Balaban" is a known associate or alias of Jerry Reynolds. The names "Kimberly Reynolds" and "Helen Balaban" are thus of great interest, especially since "Helen Balaban"'s listed snail-mail address is the same as Jerry Reynold's own address. Jerry Reynolds' full legal name is Gerald Walton Reynolds (see the 8th name on the list.)4) Kimberly Reynolds 1521 27th Ave. So# 308 Fargo, ND 58103 7) Helen Balaban 509 Morrison Ave. West Fgo, ND 58078 8) Gerald Walton PO box 612 Moorhead, MN 56561-0612
An earlier version of the same letter was identical except for the names in positions 4 and 8.
Many more examples can be found by entering the search terms "dave rhodes" reynolds into Google Groups search. Most of these search results will be responses from other people either reporting the scam, or repeating it themselves.
Netzilla has become progressively better at covering their tracks. Often, the clues to recognizing recent spam lie in examining older documents. For instance, the 1996 whois data for Netzilla showed Jerry Reynolds as the administrative contact. In 1997, it listed someone else, but the phone numbers were the same, so we know the ownership had not really changed.
As another example, once we know that "email@example.com" belongs to Netzilla, we can use this email address as a search pattern in Google Groups. This, in turn, can lead to other identities.
The following is a list of "markers" which can be used to recognize Netzilla spam:
On 18 Feb 2005, Reynolds initiated a lawsuit against me for defamation. On 21 Feb 2005, a large number of forged cancels were transmitted from Reynolds-controlled servers, targeted at netnews articles in the Google Groups archive that would have been used in my defense.
Fortunately, the forged cancels were not honored by the Google Groups Canada and U.K. servers, and the deleted articles were recoverable.
A detailed examination of the cancels and the articles they were targeted at can be found in Forged Cancels from newsfeeds.com.
To report spam, contact one or more of
A complete history may also be available.
Return to top | Return to spam summaries | complete history
The opinions expressed on this page are solely those of Ed Falk and do not necessarily represent those of any other organization, (although I hope they do). I wish to thank Rahul.net for hosting this web page.